Why Passwords Still Get Stolen: The Case for Device-Bound Credentials
88% of web app breaches involve stolen credentials. The security industry responds with more MFA and shorter tokens. Those are mitigations. The real problem is that the secret moves at all.
In 2025, credential theft rose 160% year over year. Attackers stole 1.8 billion logins from 5.8 million infected hosts, and 276 million of those credentials included active session cookies — direct access to authenticated sessions without needing a password at all. The Verizon 2025 DBIR found 88% of web application incidents involved stolen credentials. Not zero-days. Not sophisticated malware. Stolen usernames, passwords, and tokens.
The industry responds with more MFA prompts, shorter token lifetimes, and faster rotation. Those are mitigations, not fixes. On episode 92, Jasson Casey, CEO of Beyond Identity, framed it differently: “It’s not necessarily that long-lived and rotation is the problem. The problem is that it moves in the first place.”
The real problem: secrets that move
Every authentication system built on shared secrets has the same structural flaw. The secret has to travel from one place to another, and every stop creates a copy that can be intercepted.
Casey walks through what happens when a user types a password into a browser: it gets written and read from memory on the local system, then passes through a reverse proxy, a CDN, a load balancer, a Kubernetes service mesh — each terminating and re-establishing TLS, each storing the credential in memory at least temporarily. This isn’t theoretical. The 2017 Cloudbleed bug leaked chunks of heap memory — cookies, tokens, POST bodies — from adjacent requests. More recently, the Secret Blizzard threat actor has been man-in-the-middling TLS connections against diplomatic targets. Passwords, access tokens, API keys, session cookies — they all move, they all get copied into memory at multiple points, they all create attack surface. This is different from how most organizations think about zero trust: many implementations still rely on shared secrets for authentication, re-creating the perimeter’s vulnerability at the identity layer.
How device-bound credentials work
The fix starts with a simple question Casey and his team asked: “Is there a world where it didn’t have to move?” The answer uses asymmetric cryptography — the device holds a private key and only sends the public key, which reveals nothing useful. But they went further: “What if we could guarantee it didn’t move?”
The guarantee comes from hardware already in most modern devices — TPMs in laptops, Secure Enclaves in Apple devices, TrustZone in ARM. Keys generated there never leave the chip. Even an attacker with full admin access can’t extract a TPM-protected key with tools like Mimikatz. The device can also produce a cryptographic attestation proving the key was generated inside the TPM and never exported. The W3C formalized a related standard in 2025 — Device Bound Session Credentials — binding web sessions to device-specific keys so stolen cookies can’t be replayed from another machine.
What changes when credentials never leave the device
When the secret never moves, entire attack categories disappear. Credential stuffing needs a stolen password; there is none. Phishing needs a user to enter credentials on a fake site; there’s nothing to enter. Session hijacking needs a copyable token; a TPM-bound one is useless on another device. As Casey put it: “If I can guarantee credentials don’t move, then credential theft goes away. Stuffing, spraying, all of that goes away.”
The adoption curve backs the shift: 69% of users now have at least one passkey, 48% of the top 100 sites support them, and passkey login success hits 93% versus 63% for traditional auth. The distinction that matters most is hardware-bound versus software-synced passkeys. Synced passkeys (backed up through iCloud Keychain or Google Password Manager) improve usability but still expose the private key to software. Hardware-bound passkeys in TPMs or secure enclaves can’t be extracted, period. The same principle applies to AI agent authentication: non-human identities handling sensitive operations need credentials that can’t be exfiltrated from the runtime.
What actually breaks in enterprise deployment
The technology works; the deployment is where it gets hard. Casey is candid about what Beyond Identity learned: “The standard operating procedure in the identity world is to involve the entire workforce in rollouts. That’s horrible.” Asking every employee to change their password is asking them to participate in a security infrastructure deployment. “Why did we come up with a system where the end user has to be involved in what is fundamentally a technical operation?”
With device-bound credentials the goal is minimal end-user involvement — the hardware is already there, key generation can happen silently. But enterprise buyers aren’t monolithic: the champion, the budget holder, the administrator, and the end user can each block a deployment, and selling to all four can pull a product in conflicting directions. The most successful rollouts embed engineers alongside customer teams, because legacy app compatibility, BYOD policies, and device-loss recovery are the friction points that decide whether it succeeds. It’s the same pattern we see building product security into a real organization: the cryptography is the easy part; the integration is the work.